Friday, April 17, 2009

Lost your clerk's job? Have I got a job for "Q".

Britain's domestic spy agency — MI5 — is hunting for "Q".
MI6's sister organization, which carries out surveillance on terror suspects inside Britain and gives security advice to the government, is searching for someone to lead its scientific work.

"Looking for a chief scientific adviser to lead and coordinate the scientific work of the security service so that the service continues to be supported by excellent science and technology advice," MI5's Web site ad reads....

Mobile phones equipped with sensors for detecting chemical, biological or radioactive agents are already in the works. Others, such as supersensitive eavesdropping devices, will likely be rolled out for the 2012 Olympics in London. (more) (application)

SniffJoke - A Grass Roots Net Protection Effort

SniffJoke is a software you run on your computer that injects randomly generated traffic in your normal one. While it does not affect the normal communication and the content exchanged with a remote host, it has a noisy effect on the operation of a third element eavesdropping on your conversation (be it a sniffer, a passive interceptor or a Chinese trojan).

The data it injects makes the reconstruction of TCP streams very arduous (eg: wireshark, xplico). As in any concealment technique, an expert professional can understand the general flow of the transaction by reading one packet at a time, but this analysis cannot be automated, so: if they’re after you they will get you, but with this software you could consider yourself safe against mass-targeted attacks. (more)

Thursday, April 16, 2009

Anatomy of a TSCM PR Fiasco

Chapter 1 - The Disgruntled Turn TSCM Into a Four Letter Word

Canada - Embattled Vaughan Mayor Linda Jackson used taxpayers' money to have her city hall office swept for listening devices last year, a practice borrowed from her predecessor and archrival, Michael Di Biase.

Through a Freedom of Information request, residents Gino and Mary Ruffolo, former supporters turned Jackson critics, uncovered an invoice showing the mayor's office paid Protech Consult Services $2,730 for equipment and labour for "manual and electronic counter surveillance."

"It appears the taxpayer is paying for Jackson's office to be swept for bugs," Mary Ruffolo said yesterday. "What is going on? Why is the poor taxpayer paying for this?" (more)

"What is going on?"
Yellow journalism. Scandal-mongering. Sensationalism. This is not news.

"Why is the poor taxpayer paying for this?"
Inspections for illegal electronic surveillance (TSCM sweeps) are a generally-accepted security practice. Both governments and businesses routinely conduct inspections for electronic surveillance.

In local government, for example, inspections can prevent fraud in negotiations and bidding; saving taxpayers money.

Not ferreting out illegal electronic surveillance is just negligence.



Chapter 2 - The Opportunistic Smell Blood

Ursula Lebana has a $50 solution to Vaughan Mayor Linda Jackson's political problems – and 2 cents worth of advice.

"People never believe it, but 90 per cent of the time, it's the person you trust the most," says Lebana, who opened Canada's first "spy shop" back in 1991 and can attest to the fact that Cold Wars are still being waged in offices, marriages and even babies' bedrooms around the world.

And for $50, the embattled Jackson, who spent $3,000 in taxpayers' money last year to have her office swept for listening devices, could have rented one of Lebana's do-it-yourself bug detectors.

Lebana has armed everyone from entrepreneurs to parents with electronic surveillance gadgets since she hung a few Bond posters on the walls of her Yonge St. Spy Tech store and created the first Teddy cam to help parents keep an eye on their child's nanny. (more)

If you even remotely think that "one of Lebana's do-it-yourself bug detectors" can help you, then you will definitely be interested in buying this book to go along with it.

Top actress’ cell phone cloned to eavesdrop (update)

Korea - Prosecutors cleared the chief of Sidus HQ, a major entertainment agency, of replicating a cell phone of top actress Jeon Ji-hyun, 27, to track her phone calls and text messages.

Sidus was investigated for alleged hiring an expert to access phone records and messages of the actress in late November 2007, shortly before her contract with the company was to expire.


Sidus CEO Chung Hoon-tak and two other executives were under investigation for eavesdropping on Jeon, who signed with Sidus while still in high school more than 10 years ago.

The outside expert, who was hired to help copy and rig Jeon's handset, was given a one-year jail sentence last month.
(
more) (background)

3 Skimmers in 1 Week PINed

via Ben Popken...
Three different ATM skimmers were found this week and reported on blogs, raising the question of what the heck is going on considering these are supposed to be a rarity. First, our reader Dan found a skimmer on a WaMu/Chase ATM in LA. Gizmodo picked up the story and subsequently their reader Sean Seibel found a skimmer on a Chase ATM in Manhattan's East Village. Then this kid Nick McGlynn found a setup similar to the one Sean did, also on a Chase ATM. Now, when our reader Dan took the credit-card snagging device skimmer to the police he said they, "got a big kick out of the skimmer, saying they'd never seen one in person." (more) (background)

Security Alert - Be careful at ATMs and gas stations.
• If the card slot 'looks weird' (too big, cheesy, off-color, etc.), skip it.
• Cover your fingers when entering your PIN – to block overhead cameras or telescope voyeurs.
• Think you've been had? Call the branch manager or the cops, quickly.

Need A Gift? Everyone likes spy gear...

On a mission for spy gear?
Find it here...
The International Spy Museum Store features all things espionage for Real spies, Kid Spies, the Spy-curious, and Spy-Wannabes.


Check out these doormats, for example...

Fly Spies - l’Entreprenant & High Flying Lowe

Thinking about all the modern spy drones and insect-like flying surveillance bugs makes minds boggle.

Remember the good old days when spies floated?


The first decisive use of a balloon for aerial observation was performed by the aérostat l’Entreprenant ("The enterprising one") at the Battle of Fleurus in 1794. The following year, during the Siege of Mainz an observation ballon was employed again. However, the French military use of the balloon did not continue un-interrupted as in 1799, Napoleon disbanded the French balloon corps.

The Intrepid was a hydrogen gas balloon or aerostat built for use by the Union Army Balloon Corps for aerial reconnaissance purposes during the American Civil War. It was one of seven balloons constructed for the Balloon Corps and was one of the four larger balloons designed to make ascensions to higher elevations with a larger lift capacity for telegraph equipment and an operator. It was the balloon of choice for Chief Aeronaut Thaddeus Lowe overlooking the Battle of Fair Oaks.

The fateful flight over the Battle of Fair Oaks was instrumental in saving the fragmented army of Union Army General Samuel P. Heintzelman from what would have been sure defeat at the hands of the Confederates. via Wikipedia.com

Wednesday, April 15, 2009

You know some jerk will call Homeland Security.

Robot/People art by Kacie Kinzer...
In New York, we are very occupied with getting from one place to another. I wondered: could a human-like object traverse sidewalks and streets along with us, and in so doing, create a narrative about our relationship to space and our willingness to interact with what we find in it? More impo
rtantly, how could our actions be seen within a larger context of human connection that emerges from the complexity of the city itself? To answer these questions, I built robots.

Tweenbots are human-dependent robots that navigate the city with the help of pedestrians they encounter. Rolling at a constant speed, in a straight line, Tweenbots have a destination displayed on a flag, and rely on people they meet to read this flag and to aim them in the right direction to reach their goal.

Every time the robot got caught under a park bench, ground futilely against a curb, or became trapped in a pothole, some passerby would always rescue it and send it toward its goal. Never once was a Tweenbot lost or damaged. (more with video)
New Yorkers are too cool. Our spies tell us more Flying Dutchman Bots will be appearing on the streets. Updates to follow!

Spy Tie

Spy Tie comes with a pocket remote control so you can snap the looks on peoples faces when they see your incredibly ugly new cravat.

Also good for business espionage and private investigator work.


You can find Spy Tie here, right next to the ad for the digital microscope. You know, the one that says お肌・頭皮のチェックに!(Check the skin on the scalp!)

Mobiusly Loopy, Infinitely Idioic or Smart?

We now have spycams watching the people who watch spycams.

"Why???" you may ask...


...because the people watching CCTV images back in the control rooms often have too many screens to monitor at once, and so may miss the criminal or antisocial activities they are there to spot.

To the rescue of Big Brother's limited attention capabilities come Ulas Vural and Yusuf Akgul of the Gebze Institute of Technology in Turkey, who have developed a gaze-tracking camera system that watches the eyeballs of CCTV operators as they work. It then automatically produces a summary of the CCTV video sequences they have missed during their shift. (more)

PIN Crackers Nab Holy Grail of Bank Card Security

Hackers have crossed into new frontiers by devising sophisticated ways to steal large amounts of personal identification numbers, or PINs, protecting credit and debit cards, says an investigator. The attacks involve both unencrypted PINs and encrypted PINs that attackers have found a way to crack, according to the investigator behind a new report looking at the data breaches. (more)

Business Espionage - Software Swipe

NJ - Yan Zhu, also known as “Westerly Zhu”, age 31, a Chinese citizen in the U.S. on a work visa, was arrested this morning by FBI agents at his residence, 9 Victor Street, Apt 26, Lodi, New Jersey, on charges of theft of trade secrets, conspiracy, wire fraud, and theft of honest services fraud announced Weysan Dun, Special Agent In Charge. The investigation, code named “Westerly Winds”, began in November of 2008 based on a complaint from the victim company. (more)

"Wolfgang, this is the wrong funkybuddha club."

UK - Three German journalists breached the tight security cordon around the April 2 Group of 20 summit in London and managed to eavesdrop on the three-hour discussion between heads of governments...

Despite wearing the wrong identification badges Marc Hujer, Wolfgang Reuter and Christoph Schwennicke walked unchallenged into the G20 “listening room”, where government officials were listening in on talks between government heads such as Barack Obama, the US president, and Nicolas Sarkozy, his French counterpart, said one person present during the incident. “It’s not that they sneaked in, they just walked in.”

The reporters went on to write a detailed account of the discussions, which appeared in Spiegel, the weekly magazine, on April 6, detailing the debate that led to the drafting of the final summit communiqué and repeatedly using verbatim quotes from the discussions. (more)

We see similar tactics attempted at corporate off-site meetings we protect. Everything from "blenders" (people who meld with the herd) to pre and post meeting "paper-hunter-gatherers." Make sure you have a knowledgeable counterespionage specialist watching over your meetings. They will do more than just catch bugs.

The Annoy-a-tron 2.0 Strikes Again

Word went out on the wires yesterday to police and private forensic examiners...
Does anyone recognize the device in the attached photograph?


A female RP found it taped under her computer desk in her bedroom. The device is about 1.75" x 2.25". It has 3 batteries, a 2-position switch (on-off?), a 6-position sliding switch (frequency?), a cogwheel (volume or recording level?), a speaker or microphone, and possibly a reset switch. It has no ports and was not connected to anything.

Correct answers (including mine) sprayed in faster than an AA-12 ejecting shells!

Yes! The Annoy-a-tron 2.0 strikes again.

Kinda makes you wonder about forensic geeks :]Dumb-de-dumb-dumb

Monday, April 13, 2009

Take a security hint... from the most profitable company in the world!

via The Wall Street Journal...
The whole country is now worried about the specter of cyber attacks that will bring down the electricity grid.
Big Oil is worried about another kind of cybersecurity: eavesdropping.

Exxon spent $222,985 last year on security for chairman and chief executive Rex Tillerson. The bulk of that went for standard-issue stuff: a car and driver, and residential security. But just over $9,000 apparently went... “for mobile phones and other communications equipment for conducting business in a secure manner.”...

...cor
porate chieftains—especially globe-trotting oil execs–can’t live in a communications-free bubble, which would explain Exxon’s expenditure on Mr. Tillerson’s secure mobile phones.

If you’re a high-profile person, you’re going to be a target. Especially for big oil companies, when so many countries want to know what they are thinking, what their strategy is, it makes sense,” says James Andrew Lewis, senior fellow for technology and public policy at the Center for Strategic and International Studies...

Michael Klare, author of “Rising Powers, Shrinking Planet: The New Geopolitics of Energy,” says
electronic surveillance could touch executives anywhere from Moscow to their home office in suburban Dallas. “It might not only be state competitors that would be using this technology, it could be corporate competitors that would want to listen in on conversations,” he says.

Espionage in the oil business dates back to the industry’s earliest days and hasn’t remitted. Two hard drives belonging to Brazilian oil company Petrobras and containing vital data on giant offshore oil deposits were stolen last year. Brazilian authorities called it “industrial espionage.”

Exxon spokesman Alan Jeffers declined to comment on the specifics of Mr. Tillerson’s phone. All he would say is: “
Security of information is a vital part of our business controls and we take it very seriously.” (more)

Phones are just the tip of their information security iceberg.
Want Exxon-smart protection?

Click here.